CVE-2026-6696

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The Zingaya Click-to-Call plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'email', 'first_name', 'last_name', and 'phone' parameters on the plugin's sign-up admin page in all versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
zingaya	Zingaya Click-to-Call	<= 1.0

References

Timeline

Published: May 5, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-669816.5HCL AION is affected by a vulnerability where the application trusted the value of the HTTP Host header supplied in requests without validat CVE-2026-669823.3HCL AION is affected by a vulnerability where browser autocomplete was enabled on sensitive login form fields, allowing the browser to store CVE-2026-669843.1HCL AION is affected by a vulnerability where certain application responses revealed internal server file system paths. This information cou CVE-2026-669863.3HCL AION is affected by a vulnerability where user sessions did not expire after a sufficient period of inactivity. An unattended authentica CVE-2026-669875.3HCL AION is affected by a vulnerability where the account lockout mechanism did not sufficiently restrict repeated failed login attempts, al CVE-2026-67004.3The DX Sources plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.1. This is due to CVE-2026-67014.3The addfreespace plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.1.3. This is due t CVE-2026-67026.1The Publish 2 Ping.fm plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is du CVE-2026-67034.3The Responsive Blocks – Page Builder for Blocks & Patterns plugin for WordPress is vulnerable to unauthorized access in all versions up to, CVE-2026-67046.1The Blog Settings plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and i CVE-2026-67066.5Improper access control in the vault documentation feature in Devolutions Server allows an authenticated attacker to read documentation co CVE-2026-670716.5HCL DevOps Deploy / HCL Launch is susceptible to an information disclosure vulnerability when processing redacted property values. If a depl